UNITED STATES OF AMERICA 


v. 


Manning, Bradley E. 

PFC, U.S. Army, 

HHC, U.S. Army Garrison, 

Joint Base Myer-Henderson Hall 

Fort Myer, Virginia 22211 
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EXPECTED TESTIMONY 


SA David Shaver 


5 August 2013 


It is hereby agreed by the Accused, Defense Counsel, and Trial Counsel, that if Special 
Agent David Shaver were present to testify during an Article 39(a) session of this court-martial, 
he would testify substantially as follows: 

1. During my examination of PFC Manning's SD Card, Prosecution Exhibit (PE) 92, 1 found a 
file named "yada.tar.bz2.nc" and its created date was "01/30/10 10:22:19PM", as listed on PE 
105 for Identification (ID). I believe that PFC Manning had to create this encrypted cabinet 
file, similar to a "zip" file, on his Personal Mac computer, because it required specialized 
software. This software is "MCrypt" and I found "MCrypt" on his Personal Mac computer. 

2. After decrypting the cabinet file using the password PFC Manning provided Mr. Adrian 
Lamo in his chats (PE 30), I decrypted the file. The contents of the file are listed in PE 50 for 
ID. Specifically, this file contained a file named "afg_events.csv" with a "Last Written" date of 
"01/08/10 12:47:50AM" and a file named "irq_events.csv" with a "Last Written date of 
"01/05/10 02:58:10AM". A cabinet file created by "MCrypt" stores each individual file's "Last 
Written" date within its structure, so that metadata does not change when a file is added to the 
cabinet or encrypted. 

3. The "Last Written" date is synonymous with a Windows "Last Modified" date and essentially 
means that a file was last edited at that specific date or time. The "Last Written" date does not 
tell me whether the files were last edited on the SIPRNET or Personal Mac computer, nor does 
any other metadata associated with the above-referenced ".csv" files. 

4. Based on my forensic analysis, the two files could have been last edited or saved on PFC 
Manning's SIPRNET computer or on his Personal Mac. There is no forensic data available that 
would indicate the exact dates PFC Manning moved or copied the files onto his Personal Mac. I 
know they must have been on his Personal Mac before "01/30/10 10:22:19PM" which is the 
creation date of the encrypted cabinet file created on his Personal Mac, and after the dates each 
set of data was pulled, as determined by Mr. Patrick Hoeffel in paragraphs 1 1 and 12 of PE 116. 
I also cannot forensically determine whether the two files, containing the SIGACTS from the 
CIDNE-A and CIDNE-I databases, were moved or copied together or separately. 


MAJ, JA 
Trial Counsel 



Accused 
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